Re: [PATCH 5.10 1/1] Bluetooth: L2CAP: Fix uaf in l2cap_connect

[Sasha Levin <sashal@kernel.org>]

[ Sasha's backport helper bot ]

Hi,

The upstream commit SHA1 provided is correct: 333b4fd11e89b29c84c269123f871883a30be586

WARNING: Author mismatch between patch and upstream commit:
Backport author: d.privalov <d.privalov@omp.ru>
Commit author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>


Status in newer kernel trees:
6.12.y | Present (exact SHA1)
6.6.y | Present (different SHA1: b90907696c30)
6.1.y | Present (different SHA1: b22346eec479)
5.15.y | Present (different SHA1: 686e05c9dbd6)
5.10.y | Not found

Note: The patch differs from the upstream commit:
---
1:  333b4fd11e89 ! 1:  b709013bb07e Bluetooth: L2CAP: Fix uaf in l2cap_connect
    @@ Metadata
      ## Commit message ##
         Bluetooth: L2CAP: Fix uaf in l2cap_connect
     
    +    commit 333b4fd11e89b29c84c269123f871883a30be586 upstream.
    +
         [Syzbot reported]
         BUG: KASAN: slab-use-after-free in l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949
         Read of size 8 at addr ffff8880241e9800 by task kworker/u9:0/54
    @@ Commit message
         Closes: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
         Fixes: 7b064edae38d ("Bluetooth: Fix authentication if acl data comes before remote feature evt")
         Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
    +    Signed-off-by: Dmitriy Privalov <d.privalov@omp.ru>
     
      ## net/bluetooth/hci_core.c ##
     @@ net/bluetooth/hci_core.c: static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
    @@ net/bluetooth/hci_core.c: static void hci_acldata_packet(struct hci_dev *hdev, s
      	hci_dev_lock(hdev);
      	conn = hci_conn_hash_lookup_handle(hdev, handle);
     +	if (conn && hci_dev_test_flag(hdev, HCI_MGMT))
    -+		mgmt_device_connected(hdev, conn, NULL, 0);
    ++		mgmt_device_connected(hdev, conn, 0, NULL, 0);
      	hci_dev_unlock(hdev);
      
      	if (conn) {
     
      ## net/bluetooth/hci_event.c ##
    -@@ net/bluetooth/hci_event.c: static void hci_remote_features_evt(struct hci_dev *hdev, void *data,
    +@@ net/bluetooth/hci_event.c: static void hci_remote_features_evt(struct hci_dev *hdev,
      		goto unlock;
      	}
      
    @@ net/bluetooth/hci_event.c: static void hci_remote_features_evt(struct hci_dev *h
      		bacpy(&cp.bdaddr, &conn->dst);
     
      ## net/bluetooth/l2cap_core.c ##
    -@@ net/bluetooth/l2cap_core.c: static void l2cap_connect(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd,
    +@@ net/bluetooth/l2cap_core.c: static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn,
      static int l2cap_connect_req(struct l2cap_conn *conn,
      			     struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
      {
    @@ net/bluetooth/l2cap_core.c: static void l2cap_connect(struct l2cap_conn *conn, s
      		return -EPROTO;
      
     -	hci_dev_lock(hdev);
    --	if (hci_dev_test_flag(hdev, HCI_MGMT))
    --		mgmt_device_connected(hdev, hcon, NULL, 0);
    +-	if (hci_dev_test_flag(hdev, HCI_MGMT) &&
    +-	    !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &hcon->flags))
    +-		mgmt_device_connected(hdev, hcon, 0, NULL, 0);
     -	hci_dev_unlock(hdev);
     -
    - 	l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP);
    + 	l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP, 0);
      	return 0;
      }
---

Results of testing on various branches:

| Branch                    | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-5.10.y       |  Success    |  Success   |